Overview

overview

10

Static

static

3

19012025_1019_x.exe

windows7-x64

10

19012025_1019_x.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19012025_1019_x.exe

  • Size

    973KB

  • Sample

    250119-mhp2xsvkcq

  • MD5

    72d63924b474c076c3f54e556dcd3f8b

  • SHA1

    bf448f7c1d3a8906b6c697d2f2dadf58e56f7bbf

  • SHA256

    d78342ca78b975e822d380ccf2d2e8ec9dc910f91eefdeb049f28e7c97598c68

  • SHA512

    b846ade542938e2b70375620c3d2b8e8c28b1232cbf3d11c62ba21109a2d1b1733b5951ba57f1369532bc5fd75cc7466eb8552bf8d439c39418048446aebba55

  • SSDEEP

    24576:bBVRVxmQEkZkjSnbyewh+lMewKe9X7yxw7IYNoIjSst8H2se:bBmB+Q+SJwxw7IYNbjSi8H2se

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      19012025_1019_x.exe

    • Size

      973KB

    • MD5

      72d63924b474c076c3f54e556dcd3f8b

    • SHA1

      bf448f7c1d3a8906b6c697d2f2dadf58e56f7bbf

    • SHA256

      d78342ca78b975e822d380ccf2d2e8ec9dc910f91eefdeb049f28e7c97598c68

    • SHA512

      b846ade542938e2b70375620c3d2b8e8c28b1232cbf3d11c62ba21109a2d1b1733b5951ba57f1369532bc5fd75cc7466eb8552bf8d439c39418048446aebba55

    • SSDEEP

      24576:bBVRVxmQEkZkjSnbyewh+lMewKe9X7yxw7IYNoIjSst8H2se:bBmB+Q+SJwxw7IYNbjSi8H2se

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks